Skip to main content

      A cyber strategy should support the business vision, objectives and innovation agenda. Done well, it strengthens product integrity, customer experience, regulatory compliance, reputation and investor confidence, turning risk into a competitive advantage.

      We set strategies aligned to business objectives, quantify risk, assess true cost and test the effectiveness of the current programme. We then design the operating model, policy framework and management systems to deliver it, so that strategy translates into clear responsibilities, funded initiatives and measurable progress.

      How we help

      • Cyber and information security strategy and multi-year roadmap
      • Target operating model: roles, three lines of defence, RACI, CISO mandate and reporting lines
      • Security programme design, portfolio management and business cases
      • Sourcing model and capability build (in-house, co-sourced, managed)

      Outcomes

      • A clear security vision understood across the business
      • A pragmatic programme focused on business benefit
      • Investment linked to quantified risk reduction
      • Cost-effective compliance with regulation

      Governance & Compliance Frameworks

      Fragmented policies and overlapping control sets drive cost and audit fatigue. We design a unified policy hierarchy and control framework that maps once to many requirements: DORA, NIS2, ISO/IEC 27001, NIST CSF and sector rules.

      • Policy hierarchy: policies, standards, procedures and guidelines
      • Unified control library with owners, frequency and evidence requirements
      • Regulatory mapping and coverage analysis (test once, comply to many)
      • Control testing approach for first and second line
      • Exceptions and risk acceptance process

      We help organisations design, implement and enhance an Information Security Management System that works for the business, not just the auditor, and prepare for certification.

      • Gap assessment against ISO/IEC 27001:2022 and Annex A
      • ISMS scope, risk methodology and Statement of Applicability
      • Policies, procedures and control implementation support
      • Internal audit and certification readiness
      • Integration with ISO 22301, ISO/IEC 27701 and ISO/IEC 42001

      Resilient services depend on disciplined IT service management. We align service management processes with ISO/IEC 20000-1 and connect them with incident, change, capacity and continuity requirements under DORA and NIS2.

      • Service management gap assessment
      • Process design: incident, problem, change, capacity, availability and continuity
      • Integration with ICT risk management and ITSM platforms
      • Certification readiness

      Contact

      Constantinos Gavardinas

      Partner, Advisory

      KPMG in Greece

      Dimitrios Xernos
      Dimitrios Xernos

      Director, Management Consulting

      KPMG in Greece